- Sync root plugin.json and .codex-plugin/plugin.json description,
homepage, and keywords so the richer, framework-specific listing
copy isn't dropped when the marketplace normalizes the Codex
manifest from the root Agent Plugins manifest.
- Add missing keywords (authentication, authorization, oauth, oidc,
sso, rbac) that the descriptions already advertise.
- Bump both manifests to 2.1.1 to match SKILL.md's metadata.version,
which had drifted ahead after #195.
- Add interface.composerIcon, interface.logo (Auth0's official black
shield mark, squared on a white background), and interface.brandColor
(#EB5424) so the listing isn't missing its icon/logo.
- Add interface.defaultPrompt starter prompts for the ChatGPT composer.
* Fix OpenAI plugin submission errors for the auth0 plugin
- Codex interface category was "Developer tools" (lowercase "tools"),
but OpenAI's Agent Plugins schema requires the exact enum value
"Developer Tools" — fixes the "Unsupported plugin category" error.
- Add plugins/auth0/skills/auth0/agents/openai.yaml with the skill's
interface config (display_name, short_description, default_prompt),
since OpenAI's submission checker doesn't read interface settings
from SKILL.md metadata — fixes "Skill interface settings must use
agents/openai.yaml".
- Allow an agents/ directory in skill roots in the custom
skill-directory-structure skillsaw rule, since that's where the
Agent Plugins spec expects per-skill client config to live.
* Address review comments
- Fix the same category casing bug in .agents/plugins/marketplace.json
(CodeRabbit caught this second occurrence; the earlier fix only
covered plugins/auth0/.codex-plugin/plugin.json).
- Make SkillDirectoryStructureRule.ALLOWED_DIRS a frozenset so it can't
be mutated across instances (CodeRabbit).
- Exempt agents/openai.yaml from the agentskill-unreferenced-files
check, same as the existing scripts/validate-skill.sh exemption —
it's Codex-facing config, not router-linked content (skillsaw CI).
* Use reviewer-suggested short_description for the Codex interface
More specific than the placeholder — names the concrete capabilities
(MFA, SSO, RBAC, Organizations, custom domains, Universal Login) and
framework breadth instead of a generic one-liner.
* Add agents/openai.yaml to the docs/openai-plugin.md package layout tree
The Package layout diagram still only showed SKILL.md, so it no longer
matched what the plugin ships now.
* feat: package Auth0 skill for Codex plugins
* fix: use Auth0 marketplace display name
* docs: address review feedback on the Codex packaging
The Codex manifest carried a generic one-liner while the Claude and Cursor
manifests list the frameworks and features, so directory search for "Next.js"
or "MFA" would not have matched this listing. Reuse the marketplace copy for
both `description` and `interface.longDescription`.
Also drop the "Method N" numbering now that there are four install paths and
the newest one sat above the recommended path, sort `.agents/` into the
directory tree, and list both docs/ files in the tree and in AGENTS.md.
* docs: describe the Codex marketplace as tracking main, not local
The marketplace entry resolves plugins/auth0 from the published main branch, so
calling it "local testing" was wrong — an uncommitted working tree is not what
gets installed. Reword the four places that claimed it and note that changes
need pushing before reinstalling.
---------
Co-authored-by: Subhankar Maiti <35273200+subhankarmaiti@users.noreply.github.com>
Co-authored-by: Subhankar Maiti <subhankar.maiti@okta.com>
* fix(auth0): harden against security-scan false positives
The v2.0 re-architecture (#137) triggered a critical finding on the
Agent Trust Hub / Socket / Snyk scans. This addresses the actionable,
scan-scoped surface without removing legitimate behavior.
Placeholder URLs
- Replace registrable placeholder hostnames (your-api.com,
your-production-domain.com, your-app.com, your-spa-domain.com,
your-web-app.com, your-domain.com) with RFC-2606 example.com forms
across references/*.md. Kills the "malicious URL" finding
(your-production-domain.com) and pre-empts future URL-reputation hits.
Matches the skill's already-dominant `api.example.com` convention.
.auth0.com domain placeholders and client-id/secret tokens are left
as-is: not registrable / not URLs, so not a scanner surface.
Move the behavioral eval harness out of the skill dir
- Socket flagged tests/behavioral/graders.mjs (reads .env, pipes source
into the local `claude` CLI via execa). That's a dev-only test grader,
but it sits inside per-skill scan scope. Move tests/ -> repo-root
evals/ so the executable harness is no longer bundled with the skill
consumers install. Fix run-evals.mjs path resolution, the routing
checker's routing-cases.json lookup, the README, and the AGENTS.md
layout doc.
skillsaw: exempt template-routed reference families
- framework-*.md / tooling-*.md are routed only via the
`references/framework-{framework}.md` / `tooling-{tooling}.md`
placeholder templates, which skillsaw's literal-scan
agentskill-unreferenced-files rule can't resolve. Co-located tests
were previously (accidentally) satisfying that reachability; moving
them out exposed it. Their reachability is properly enforced by
scripts/check_router_reachability.py, so exempt the two template-routed
families in .skillsaw.yaml. feature-*/pattern-* orphan detection stays.
Verified: skillsaw --strict (0/0, grade A), check_router_reachability,
check_routing_evals, and run-evals --dry-run (17 case files) all pass.
* fix(auth0): keep load_cases skill-dir-relative for unit tests
The previous commit hardcoded routing-cases.json to repo-root evals/,
which broke scripts/test_check_routing_evals.py — the unit tests build a
self-contained temp skill with its own tests/routing-cases.json and rely
on load_cases(skill_dir) reading from that dir.
Prefer a skill-local tests/routing-cases.json when present (unit tests),
fall back to repo-root evals/routing-cases.json otherwise (production,
after the harness move). Both the pytest suite (10/10) and the real
check pass.
* chore(auth0): bump plugin + skill version to 2.0.1
Patch bump for the security-scan hardening: placeholder-URL cleanup,
eval harness move out of the skill dir, and the skillsaw template-route
exemption. No new routes or breaking changes. Updates all six plugin/
marketplace manifests and SKILL.md frontmatter in lockstep.
* feat(android): add auth0-android-major-migration skill
Adds a spec-driven skill that upgrades an existing com.auth0.android:auth0
(v3) integration to the next major version (v4), the Android counterpart to
auth0-swift-major-migration.
The skill is source-driven and grep-gated: it fetches the v4 SDK's actual
Kotlin source to confirm signatures, audits which Auth0 APIs the project
actually calls, and applies only the breaking changes that affect real call
sites — then builds until green and emits a migration summary.
Target version is argument-based: an optional version argument is validated
(must be a published tag, within the next major, and not a downgrade) and the
skill stops and asks on failure; when omitted it auto-resolves the latest v4
release (including pre-releases). Covers the v4 prerequisite gate (minSdk 26,
Java 17, Gradle/AGP/Kotlin) and the documented breaking and behavioral changes.
Includes references (process, security), an eval suite, and registers the
skill across the plugin manifests and READMEs.
* fix(android): address markdownlint nits in migration skill docs
Add blank lines around fenced code blocks (MD031) and language
specifiers on checklist/diagram fences (MD040) in SKILL.md, process.md,
and security.md. Docs-only; no behavioral change.
* docs(android): note expires_in JSON key is unchanged; renumber §9 subsections
* Adds support swift sdk for migrating to major version releases
* Updates README.md PLUGIN.md plugin.json files
* Updates README.md, SKILL.md to have latest major version
* Migration is based on SDK code. Rather than migration guide
* Remove sequential migration
* Updates skill with code examples
* Updates requestable and mfa client related code examples. README.md and other docs updated
* Removes v1 or v2 to v3. Prompts user to specify v3 version to migrate. Removes grep based file search
* refers to latest tag on v3 instead of hardcoded tag
* Skill version set to 1.0.0
* fixes new error surface with all errors covered in skill.md
* Skill takes version as argument
* Resolve PR #104 review comments
- license: Proprietary → Apache-2.0 (CodeRabbit critical)
- Step 2: replace version prompt with arg-validation (3-check gate) + auto-resolve latest v3 when no arg; use find instead of globstar for Package.resolved
- Step 1/7/8: replace hardcoded iPhone 16 simulator with dynamic xcrun simctl lookup
- graders.json: regex [3-9] → ([3-9]|[1-9][0-9]+) to support v10+ (CodeRabbit)
- graders.ts: expand contains_any/not_contains_any to one grader per value (CodeRabbit data-loss fix)
- security.md: cat **/Auth0.plist → find . -name Auth0.plist (globstar fix)
- cursor-plugin/plugin.json: add missing comma after "major comma after" major version upgrades"
- process.md: add plaintext language tag to signature confirmation code block
* Add run-evals.mjs and PROMPT.md for swift migration eval runner
CodeRabbit flagged that package.json scripts referenced run-evals.mjs which
didn't exist in the tests directory. Copy the shared runner and add PROMPT.md
with the task prompt used for live evaluation runs.
* Rename PROMPT.md to prompt.md (kebab-case lint fix)
CI requires markdown files to be kebab-case. Update run-evals.mjs to
match the new filename.
* Fix unlabeled code block fences in security.md, process.md, SKILL.md
- security.md: add plaintext language tag to all 4 checklist blocks (lines 13, 27, 40, 48)
- process.md: add plaintext tag to backend pattern block
- SKILL.md: add plaintext tag to Carthage Cartfile block
* chore: bump plugin version to 1.1.0
Bump version so Claude Code marketplace detects new skills added
since v1.0.0: auth0-branding, auth0-custom-domains, go-jwt-middleware,
auth0-ionic-react, auth0-ionic-angular, auth0-ionic-vue.
Updated descriptions and keywords to reflect full skill catalog.
* chore: bump Cursor and Codex plugin versions to 1.1.0
Same version bump and description updates as the Claude plugin —
adds branding, custom-domains, go-jwt-middleware, ACUL, CLI, and
Ionic skills to metadata.
Bharath Natarajan